4 ms·

Actual instrument-rated pilot here. What people (including pilots) do under stress is resort to simple actions drilled in by training. That's why emergency pr

Actual instrument-rated pilot here. What people (including pilots) do under stress is resort to simple actions drilled in by training. That's why emergency procedure training is a major part of pilot training curriculum. What goes away first under stress is capability for complex reasoning, which is what one would need to figure out what the heck is going on and take appropriate action. In this case an a/c doing uncommanded dive can be a result of three things: elevator controls malfuncion (unlikely in modern jets, the mechanisms for transmitting control forces from the yoke to the elevator are multiply redundant and well-understood to be critical), structural breakdown (empennage falling off would do that), or run-away elevator or stabilizer trim. In most a/c the runaway trim can be only caused by malfunctioning auto-pilot (that's why APs have multiple redundant ways to disable them), so the pilots faced this situation react by trying to disable AP in all available ways and then immediately jumping to conclusion that there's something catastrophically wrong with elevator system or even airframe integrity. The thought that there could be yet another system which can do major trim adjustment doesn't even enter their consciousness. Training (and/or being in a position where there's no immediate stress of wrangling misbehaving a/c) would help to get to the correct solution (disabling trim motor by pulling the circuit breaker). That said, flying an a/c seriously out of trim is hard, and can cause an accident on its own (the fine pitch control is gone, and you can even be so far out of trim that you cannot do landing flare no matter how hard you pull up, which in heavy jets would result in structural breakdown when the plane slams into runway).

StavrosK 8y ago
My question is why doesn't the "omg something is seriously fucked up give me manual control NOW" button disable the MCAS as well? That seems like a UX failure.
- dpe82 8y ago
  That's an excellent question, and will likely be one of the conclusions of the accident investigations.
- varjag 8y ago
  Could be related to the issue that MAX is unstable in flight with that system off. Unlike previous 737s.
  - _ph_ 8y ago
    No, under normal conditions the MAX isn't unstable. The instability comes only at high angles of attack (close to stalling) and only there the MCAS system should kick in. It was meant to be the equivalent to ESP systems in cars.
    - gomijacogeo 8y ago
      Do we know, exactly, how much of the 737 Max 8's flight envelope was lost compared to earlier models? I'm getting the feeling that the instability happens far closer to the regular maneuvering envelope than is being alluded to in the press.
    - mpweiher 8y ago
      Yep. Except that the "exceptional" conditions under which the MCAS kicks in can also "occur" (=seem to occur) due to sensor failure.
- inferiorhuman 8y ago
  MCAS is designed to work only with autopilot disengaged. With autopilot and autothrottle engaged there would be similar logic at play because the general goal would be to not have the automation induce a stall. With everything disabled there is a risk that applying full throttle will result in the airplane pitching up dramatically beyond the ability of the elevator to pitch the airplane back down and potentially inducing a stall. This is an inherent problem with putting big engines under the wing (and is a problem in the 737 Classic[0], NG, and MAX). You could almost certainly disable just about anything by pulling the appropriate circuit breaker. You don't want to do that because the plane may be left in a state where you can't control it manually and you only have a few thousand feet of altitude to recover. There are, in fact, two switches to turn off the electronic control of the horizontal stabilizer. The previous Lion Air crew used them after the pilot riding in the jumpseat went back and grabbed his copy of what I'd assume was the flight manual and had an ah-hah moment[1]. The flight 610 crew were pouring over something (quick reference handbook?) but didn't express any awareness of the stabilizer being trimmed[2]. Depending on how bad things got there are a few problems with this. First, electrically moving the stabilizer is much faster than moving it manually. MCAS can operate at two speeds, IIRC both are slower than the speed dictated by the buttons on the yoke (plus the buttons on the yoke will pause MCAS). But even MCAS will move the stabilizer much faster than a pilot could by cranking the manual wheels. I believe that moving the stabilizer from one extreme at the fastest speed to the other takes about a minute. You can find videos of the stabilizer mechanism on a 777 on youtube, it's just not something that's designed to move quickly. The next problem is that if the stabilizer is pitched down sufficiently (perhaps by MCAS), your first instinct may be to pull back on the yoke (to move the elevator) to regain pitch. Well, once you've done that the aerodynamic forces may be such that you can't move the stabilizer into a nose up position until you let go of the yoke and let the plane pitch down further (Boeing references needing to unload the stabilizer in some documents). That's something you've gotta have cat-like reflexes for when you're already flying so low. The really sad part is that the pilots could have disabled MCAS and retained electric control over the stabilizer by extending the flaps. But how are the pilots going to know this when Boeing refused to document anything? 0: http://avherald.com/h?article=419f2f9e http://avherald.com/h?article=419f2f9e 1: https://www.grid.id/read/04966850/deretan-kejanggalan-yang-dirasakan-penumpang-jt-610-rute-denpasar-jakarta-sebelum-pesawat-lion-air-jatuh-pada-senin-pagi https://www.grid.id/read/04966850/deretan-kejanggalan-yang-d... 2: https://www.straitstimes.com/asia/se-asia/cockpit-voice-recorder-of-doomed-lion-air-jet-depicts-pilots-frantic-search-for-fix https://www.straitstimes.com/asia/se-asia/cockpit-voice-reco...
- tim333 8y ago
  Well, there is no such button. Perhaps there should be though a better solution might be to fix the automation. Airbus planes seem to work ok without a button but don't have a crash the plane if one sensor fails system.
  - mbreese 8y ago
    There an AirFrance (Airbus) flight a few years back that crashed over the Atlantic that was partially the result of a stuck pitot tube. I remember at the time one of the debates was how automated Airbus planes were over Boeing. Pilots seemed split as to which system they preferred, but generally wanted more control, not less. https://en.m.wikipedia.org/wiki/Air_France_Flight_447 https://en.m.wikipedia.org/wiki/Air_France_Flight_447
- unionemployee 8y ago
  That would be the autopilot disconnect button or, in this case, the trim switch, the pressing of which is the correct immediate response to this occurrence, followed by the disabling of the system using switches on the center pedestal. While it's certainly hazardous for Boeing to knowingly expose pilots to this occurrence, I'm also conflicted by the fact that they failed to respond properly. The procedure is similar on Boeing, Airbus, Embraer and Bombardier aircraft. Standardized, in a way.

StavrosK 8y ago

My question is why doesn't the "omg something is seriously fucked up give me manual control NOW" button disable the MCAS as well? That seems like a UX failure.

dpe82 8y ago
That's an excellent question, and will likely be one of the conclusions of the accident investigations.
varjag 8y ago
Could be related to the issue that MAX is unstable in flight with that system off. Unlike previous 737s.
- _ph_ 8y ago
  No, under normal conditions the MAX isn't unstable. The instability comes only at high angles of attack (close to stalling) and only there the MCAS system should kick in. It was meant to be the equivalent to ESP systems in cars.
  - gomijacogeo 8y ago
    Do we know, exactly, how much of the 737 Max 8's flight envelope was lost compared to earlier models? I'm getting the feeling that the instability happens far closer to the regular maneuvering envelope than is being alluded to in the press.
  - mpweiher 8y ago
    Yep. Except that the "exceptional" conditions under which the MCAS kicks in can also "occur" (=seem to occur) due to sensor failure.
inferiorhuman 8y ago
MCAS is designed to work only with autopilot disengaged. With autopilot and autothrottle engaged there would be similar logic at play because the general goal would be to not have the automation induce a stall. With everything disabled there is a risk that applying full throttle will result in the airplane pitching up dramatically beyond the ability of the elevator to pitch the airplane back down and potentially inducing a stall. This is an inherent problem with putting big engines under the wing (and is a problem in the 737 Classic[0], NG, and MAX). You could almost certainly disable just about anything by pulling the appropriate circuit breaker. You don't want to do that because the plane may be left in a state where you can't control it manually and you only have a few thousand feet of altitude to recover. There are, in fact, two switches to turn off the electronic control of the horizontal stabilizer. The previous Lion Air crew used them after the pilot riding in the jumpseat went back and grabbed his copy of what I'd assume was the flight manual and had an ah-hah moment[1]. The flight 610 crew were pouring over something (quick reference handbook?) but didn't express any awareness of the stabilizer being trimmed[2]. Depending on how bad things got there are a few problems with this. First, electrically moving the stabilizer is much faster than moving it manually. MCAS can operate at two speeds, IIRC both are slower than the speed dictated by the buttons on the yoke (plus the buttons on the yoke will pause MCAS). But even MCAS will move the stabilizer much faster than a pilot could by cranking the manual wheels. I believe that moving the stabilizer from one extreme at the fastest speed to the other takes about a minute. You can find videos of the stabilizer mechanism on a 777 on youtube, it's just not something that's designed to move quickly. The next problem is that if the stabilizer is pitched down sufficiently (perhaps by MCAS), your first instinct may be to pull back on the yoke (to move the elevator) to regain pitch. Well, once you've done that the aerodynamic forces may be such that you can't move the stabilizer into a nose up position until you let go of the yoke and let the plane pitch down further (Boeing references needing to unload the stabilizer in some documents). That's something you've gotta have cat-like reflexes for when you're already flying so low. The really sad part is that the pilots could have disabled MCAS and retained electric control over the stabilizer by extending the flaps. But how are the pilots going to know this when Boeing refused to document anything? 0: http://avherald.com/h?article=419f2f9e http://avherald.com/h?article=419f2f9e 1: https://www.grid.id/read/04966850/deretan-kejanggalan-yang-dirasakan-penumpang-jt-610-rute-denpasar-jakarta-sebelum-pesawat-lion-air-jatuh-pada-senin-pagi https://www.grid.id/read/04966850/deretan-kejanggalan-yang-d... 2: https://www.straitstimes.com/asia/se-asia/cockpit-voice-recorder-of-doomed-lion-air-jet-depicts-pilots-frantic-search-for-fix https://www.straitstimes.com/asia/se-asia/cockpit-voice-reco...
tim333 8y ago
Well, there is no such button. Perhaps there should be though a better solution might be to fix the automation. Airbus planes seem to work ok without a button but don't have a crash the plane if one sensor fails system.
- mbreese 8y ago
  There an AirFrance (Airbus) flight a few years back that crashed over the Atlantic that was partially the result of a stuck pitot tube. I remember at the time one of the debates was how automated Airbus planes were over Boeing. Pilots seemed split as to which system they preferred, but generally wanted more control, not less. https://en.m.wikipedia.org/wiki/Air_France_Flight_447 https://en.m.wikipedia.org/wiki/Air_France_Flight_447
unionemployee 8y ago
That would be the autopilot disconnect button or, in this case, the trim switch, the pressing of which is the correct immediate response to this occurrence, followed by the disabling of the system using switches on the center pedestal. While it's certainly hazardous for Boeing to knowingly expose pilots to this occurrence, I'm also conflicted by the fact that they failed to respond properly. The procedure is similar on Boeing, Airbus, Embraer and Bombardier aircraft. Standardized, in a way.